Privacy Policy

Information we collect

An evaluation does not require an account. To start one, the server requires a first name, last name, email, phone, Florida as the state, and at least one animal name and type. A housing address is stored only if you enter one. Payment comes first. After payment, the account or status page asks for the breed and a short note on how the animal helps with day-to-day stress or mental health. The clinician needs both before review.

If a letter is issued, we store the clinician’s decision, notes, and the letter details. The clinician is a Florida-licensed APRN. Letters for landlords are in English. Clinical calls are in English or Spanish. Approval is never automatic, and this policy does not promise that a landlord or HOA will accept a letter.

An account, if you create one, stores an email, a username, and a display name. The password is stored only as a hash. If you turn them on, we also store an authenticator-app secret, passkeys, or a Google or Apple sign-in id. A contact form message stores the name, email, and message you send.

We collect IP addresses and browser and device information for security and fraud prevention, for example to stop blocked or fraudulent orders. We keep them only as long as we need them for that purpose.

Who receives data

• Payments are processed by Stripe (card or Link, plus Klarna or Affirm when the charge is at least $250) or by PayPal. Stripe can collect a billing address. If you pay with PayPal, PayPal handles your PayPal sign-in and payment details and sends us the payment status and amount. We store the order number, the amount, and the Stripe or PayPal payment ids. We do not store the full card number.
• Resend sends email. Customer mail includes order, status, and the letter PDF if one is issued. The owner alert for a new paid order includes the name, phone, animal details, and the checkout note. We store the recipient, subject, and Resend message id for those sends.
• Neon hosts the database that holds accounts and orders.
• Google Analytics 4 loads on public pages only when a measurement id is set on that deploy. The tag is configured with anonymize_ip on. A page address sent to Google is the path plus only utm_source, utm_medium, utm_campaign, utm_content, and gclid. Events are form start (form name and language), begin checkout (price), and purchase (order number and amount). The intake note is not sent to Google Analytics. The tag does not load on /account, /status, /admin, /clinician, /after-approval, /cancel, or /api.
• Google Ads loads on those same public pages when an ads id is set. A conversion can include the amount and, for a purchase, the order number. If the visit URL has gclid, gbraid, or wbraid, we store that click id in a first-party cookie for 90 days and on the order.
• When those Google tags load, Google can set its own cookies, including the usual _ga cookies. This code does not show a cookie banner and does not turn those cookies off.
• Sentry receives error reports, and a sample of performance traces, when a DSN is set. Default personal data is off. Server events drop the cookie and authorization headers before they are sent. A sample of error sessions can include a replay with all text masked and all media blocked. We do not record every visit.
• Upstash Redis, when its URL and token are set, stores rate-limit counters keyed by IP address. Those counters expire with the limit window.
• Telegram, when a bot token and chat id are set, receives an owner alert with the order number and the amount only. That alert does not include a name, email, or phone.
• Hosting: the site runs on Vercel, which processes request data such as IP address and browser type to serve pages and keep logs, under Vercel's own policy.
• X direct messages: people may message @OFESALetterFL on X; those messages are held by X under X's policy; an AI assistant (Sofia) answers using public site information and reads order status only when the person gives an order number; it does not give medical or legal advice; unknown questions go to support@officialesaletter.com.

Text messages

We do not send text messages. The SMS sender in this code does not call a phone carrier. We still store the phone number on the order because checkout requires it.

How we use information

• Run the clinical evaluation and prepare housing documentation only when the clinician decides it is appropriate
• Take payment, send email about the order, and answer support
• Measure public-page visits and ad conversions, without the intake note
• Record errors so we can fix the site
• Limit repeated requests by IP address
• Keep the order so status lookup by order number still works

What we do not do

We do not sell health information. We are not an ESA registry, and we do not sell membership IDs or patches. The verify page tells a landlord how to check the clinician’s public Florida license. It does not show your evaluation answers.

Cookies and browser storage

• esa_customer_session: sign-in cookie, 8 hours, HTTP-only
• oel_locale: language choice, 1 year
• oel_click: ad click id, 90 days, only if the visit had one
• A session draft of the start form (name, email, phone, state, and animals) stays in the browser tab until it closes or the draft is cleared

Retention and deletion

You can delete the account on My Account, or email us from the account email with the subject “Delete my account.” We reply by email. Deleting the account removes the login row: email, username, display name, password hash, authenticator secret, passkeys, Google or Apple sign-in id, and password-reset links.

The order stays. That includes the name, email, phone, state, housing address if you entered one, animal details, intake note, clinician notes and decision, letter details, amount, Stripe or PayPal ids, and any ad click id stored on the order. Status lookup with the order number still works. The product code does not set an end date for that order.

An account with no login for 18 months is removed the same way. The order stays.

Account deletion does not erase the browser cookies on your device, and it does not erase copies already received by Stripe, PayPal, Resend, Google, or Sentry.